v0.7.8: security hardening, code hygiene, MSFT oauth provider, new atlassian assets and google calendar tools#5088

Merged

waleedlatif1 merged 24 commits into

mainfrom

Jun 16, 2026

Commits on Jun 15, 2026

chore(deps): bump js-yaml to 4.2.0 and nodemailer to 8.0.9 in apps/sim (#5067)
waleedlatif1
authored
fix(execute): reject only cross-site session execution (CSRF guard) (#5068)
TheodoreSpeaks
authored
fix(providers): pin Azure OpenAI/Anthropic endpoints to validated IP (#5060)
waleedlatif1
authored
refactor(table): split the 5.3k-line service.ts god-file into per-concern modules (#5069)
waleedlatif1
authored
fix(credential-sets): stop leaking open-invite tokens to all users (#5074)
waleedlatif1
authored
feat(copilot): server-side mothership tool/vfs/file metrics (#5071)
Sg312
authored
feat(jsm): add Atlassian Assets (Insight/CMDB) tools for asset management (#5072)
waleedlatif1
authored
fix(uploads): authorize internal file URLs before download (#5049)

waleedlatif1
and
icecrasher321
authored
feat(auth): OAuth-only signup with Microsoft provider (#5073)
TheodoreSpeaks
authored

Commits on Jun 16, 2026